Glue or EMR in a private subnet accesses S3.
Avoid an internet gateway and limit access to the required buckets.
Which authentication approach is most appropriate?
Use an S3 Gateway VPC Endpoint together with endpoint, bucket, and IAM policies.
Detailed explanation
This exposes an internet path and violates the requirement.
This exposes an internet path and violates the requirement.
Public access removes authentication and network boundaries.
Public access removes authentication and network boundaries.
The VPC route reaches S3 privately and the endpoint can restrict buckets and actions.
The VPC route reaches S3 privately and the endpoint can restrict buckets and actions.
CloudTrail records API activity but does not provide connectivity.
CloudTrail records API activity but does not provide connectivity.
Check official documentation
Compare the following points with the official documentation.
AWS VPC gateway endpoints for S3、endpoint policy、S3 bucket policyの公式説明を確認する。
What to confirm
VPCエンドポイントと公開バケット・パブリックIPの違いを説明できる。
Key points
- VPC endpoint
- Gateway endpoint
- Endpoint policy
- Private subnet
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Layered control
IAM, bucket, endpoint, and organization policies must agree on the intended access.
Reachability
Check DNS, routes, region, and service support when troubleshooting a private path.